External Data cabundle should be referenceable from a secret

[rumstead]

The provider CRD expects the cabundle to be a pem base64 encoded string. Unfortunately, this doesn't work well for using tools like cert manager or vault to manage certs for us.

We should allow the provider CRD to reference Kubernetes secrets and can instruct the controller to load them at runtime. The pattern is followed by other tools like crossplane (specifically here) and even built in the ingress CRD.